A global law enforcement operation has successfully taken down First VPN, a service utilized by cybercriminals, including ransomware groups, for concealing their activities. Conducted between May 19 and 20, 2026, the operation led to the seizure of numerous servers across 27 countries and the arrest of the VPN's administrator. Authorities gained access to user data and operational intelligence that could link users to cybercrime activities.
This operation highlights the dual-use nature of privacy tools, reinforcing that while they can protect legitimate users, they also provide cover for criminal activities. Europol noted that this action resulted in advancements in multiple investigations and the sharing of intelligence on hundreds of criminal users.